tk-bclub[.]com

tk-bclub.com is currently active and classified as a high‑risk generic phishing site targeting investment victims. The domain was registered on 19 August 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses the authoritative nameservers b.tk-bclub.com and club.tk-bclub.com. DNS resolution points to the IPv4 address 176.123.0.199, which is hosted by Alexhost SRL in the Republic of Moldova. The web server presents an HTTPS certificate issued by Let’s Encrypt (R12) and runs Nginx with the OpenResty module. A single blocklist entry has already listed the domain, and PhishDestroy actively blocks it. VirusTotal reports that 15 of 91 security vendors have flagged the domain, indicating a moderate level of detection across the ecosystem. The page title returned by HTTP 200 responses is “One moment, please…”, but the content of the page has not been publicly disclosed, leaving the exact phishing lure unknown. Given the observed infrastructure—recent registration, Moldova‑based hosting, and multiple vendor detections—defenders should add the domain and its IP address to network‑level deny lists, monitor for related traffic patterns, and consider sink‑holing the host to disrupt potential victim acquisition. Continuous re‑evaluation is advised as further payload or credential‑harvesting behavior may emerge.